Key Takeaways
- • Binance says it has begun recovering affected assets for users after a hack that drained roughly $6.3bn (£4.7bn) in cryptocurrency, which the BBC describes as thought to be the largest crypto theft in history.
- • Binance says it has reserved over $6.3bn to cover the incident, including $5bn already held in the exact token assets that were impacted, with the remainder being acquired through various channels.
- • Around $3bn in assets had been frozen, with frozen or protected assets still subject to ongoing recovery and verification.
- • Richard Teng, Binance co-chief executive, said the investigation suggests the breach may have begun with a compromised DevOps engineer's laptop, describing it as a complex attack.
- • Analysts have pointed to North Korean hacking unit TraderTraitor, though no group has claimed responsibility, and a cyber-security expert expects attackers to launder funds over months or years.
- • The UK Financial Conduct Authority said it is engaging with Binance to understand the impact, noting Binance is not registered with the FCA to provide crypto services in the UK.
Summary
Binance, the world's largest crypto exchange, said it has "begun recovering affected assets for users" after a cyberattack that the BBC reports is thought to be the largest crypto hack on record, with $6.3bn (£4.7bn) in cryptocurrency stolen. Trading on Binance Alpha was temporarily suspended following the incident. In its latest update, the firm reiterated its commitment to cover losses through company funds and said it had reserved over $6.3bn to cover the incident. Of that, $5bn is already held in the exact token assets affected, and the company is completing purchases of the remaining amount through various channels, a process it said could take longer. Binance said frozen or protected assets remain subject to ongoing recovery and verification, and that it had earlier reported approximately $3bn in frozen assets. The company is working with law enforcement and partners to trace, freeze and recover additional funds.
Binance co-chief executive Richard Teng said the initial investigation suggests the incident may have begun with a compromised DevOps engineer's laptop, while describing it as a complex attack. No group has claimed responsibility. Analysts have pointed to North Korean hacking unit TraderTraitor, and BBC correspondent Kurumi Mori noted that North Korean state-linked groups are believed to have stolen at least $2.02bn in cryptocurrency in 2025, making crypto theft a major revenue source for the regime.
Cyber-security experts cited by the BBC expect a prolonged recovery effort. Jake Moore, Global Cybersecurity Advisor at ESET, said attackers are likely to move funds thousands of times to obscure the trail, and that law enforcement's best chance of attribution lies in funds eventually being converted into fiat currency. Joe Hancock of Mishcon de Reya said laundering will likely take weeks or months, with assets that can be frozen disposed of first. The BBC also reported that the UK Financial Conduct Authority is aware of the incident and engaging with Binance, noting that Binance is not registered with the FCA to provide crypto services in the UK and stopped accepting new UK retail customers in 2023.
Binance founder Changpeng Zhao rebuked Elon Musk after Musk responded with a worried-face emoji to commentary comparing Binance's reassurances to those FTX's Sam Bankman-Fried gave before FTX's 2022 collapse. Musk has not replied. Market participants' main concern remains whether Binance can fully cover the losses, a question the company says it is addressing through reserves and recovery efforts.
Binance co-chief executive Richard Teng said the initial investigation suggests the incident may have begun with a compromised DevOps engineer's laptop, while describing it as a complex attack. No group has claimed responsibility. Analysts have pointed to North Korean hacking unit TraderTraitor, and BBC correspondent Kurumi Mori noted that North Korean state-linked groups are believed to have stolen at least $2.02bn in cryptocurrency in 2025, making crypto theft a major revenue source for the regime.
Cyber-security experts cited by the BBC expect a prolonged recovery effort. Jake Moore, Global Cybersecurity Advisor at ESET, said attackers are likely to move funds thousands of times to obscure the trail, and that law enforcement's best chance of attribution lies in funds eventually being converted into fiat currency. Joe Hancock of Mishcon de Reya said laundering will likely take weeks or months, with assets that can be frozen disposed of first. The BBC also reported that the UK Financial Conduct Authority is aware of the incident and engaging with Binance, noting that Binance is not registered with the FCA to provide crypto services in the UK and stopped accepting new UK retail customers in 2023.
Binance founder Changpeng Zhao rebuked Elon Musk after Musk responded with a worried-face emoji to commentary comparing Binance's reassurances to those FTX's Sam Bankman-Fried gave before FTX's 2022 collapse. Musk has not replied. Market participants' main concern remains whether Binance can fully cover the losses, a question the company says it is addressing through reserves and recovery efforts.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.